diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8c5b424..17e31a65 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,10 @@ and this project adheres to
 - New flag `--local-frontend` to serve dinamically changeable frontend files
   from disk as opposed to the ones that were compiled into the binary.
 
+### Changed
+
+- Permissions on filter files are now `0o644` instead of `0o600` ([#3198]).
+
 ### Deprecated
 
 <!--
@@ -43,6 +47,7 @@ released by then.
 [#3184]: https://github.com/AdguardTeam/AdGuardHome/issues/3184
 [#3185]: https://github.com/AdguardTeam/AdGuardHome/issues/3185
 [#3186]: https://github.com/AdguardTeam/AdGuardHome/issues/3186
+[#3198]: https://github.com/AdguardTeam/AdGuardHome/issues/3198
 
 
 
diff --git a/internal/home/filter.go b/internal/home/filter.go
index de2ad2ef..91cedd7e 100644
--- a/internal/home/filter.go
+++ b/internal/home/filter.go
@@ -559,6 +559,15 @@ func (f *Filtering) updateIntl(filter *filter) (updated bool, err error) {
 		}
 	}()
 
+	// Change the default 0o600 permission to something more acceptable by
+	// end users.
+	//
+	// See https://github.com/AdguardTeam/AdGuardHome/issues/3198.
+	err = tmpFile.Chmod(0o644)
+	if err != nil {
+		return updated, fmt.Errorf("changing file mode: %w", err)
+	}
+
 	var reader io.Reader
 	if filepath.IsAbs(filter.URL) {
 		var f io.ReadCloser
diff --git a/internal/updater/updater.go b/internal/updater/updater.go
index 47ae1397..0cc49f9e 100644
--- a/internal/updater/updater.go
+++ b/internal/updater/updater.go
@@ -332,7 +332,7 @@ func tarGzFileUnpackOne(outDir string, tr *tar.Reader, hdr *tar.Header) (name st
 			return "", nil
 		}
 
-		err = os.Mkdir(outputName, os.FileMode(hdr.Mode&0o777))
+		err = os.Mkdir(outputName, os.FileMode(hdr.Mode&0o755))
 		if err != nil && !errors.Is(err, os.ErrExist) {
 			return "", fmt.Errorf("os.Mkdir(%q): %w", outputName, err)
 		}
@@ -352,7 +352,7 @@ func tarGzFileUnpackOne(outDir string, tr *tar.Reader, hdr *tar.Header) (name st
 	wc, err = os.OpenFile(
 		outputName,
 		os.O_WRONLY|os.O_CREATE|os.O_TRUNC,
-		os.FileMode(hdr.Mode&0o777),
+		os.FileMode(hdr.Mode&0o755),
 	)
 	if err != nil {
 		return "", fmt.Errorf("os.OpenFile(%s): %w", outputName, err)